1+ #! /bin/sh -e
2+
3+ # ============================================================
4+ # Before running this script, sign any apps with
5+ # hardended runtime:
6+ # ------------------------------------------------------------
7+ # codesign --force -s "$signID" -v "$appFile" --deep --strict --options=runtime
8+ #
9+ # echo "\nVerifying ..."
10+ # spctl -vvv --assess --type exec "$appFile"
11+ # codesign -dvv "$appFile"
12+ # codesign -vvv --deep --strict "$appFile"
13+ # ------------------------------------------------------------
14+
15+
16+ # ============================================================
17+ # Notarise either a pkg installer or zip archive
18+ # ------------------------------------------------------------
19+ # Environment variables to set:
20+ # arg 1 Set to the app path
21+ # arg 2 Set to the bundle ID
22+ # arg 3 Set to the app specific Apple username
23+ # arg 4 Set to the app specific Apple password
24+ # ------------------------------------------------------------
25+
26+ ROOT=$( cd " $( dirname " $0 " ) " ; pwd)
27+ cd $ROOT
28+
29+ APP_PATH=" $1 "
30+ BUNDLE_ID=" $2 "
31+ AC_USERNAME=" $3 "
32+ AC_PASSWORD=" $4 "
33+
34+ if [ -z " $APP_PATH " ; then
35+ echo " ERROR: First arg needs to be the path to the app or pkg to notarise" && exit 1
36+ fi
37+
38+ if [ -z " $BUNDLE_ID " ; then
39+ echo " ERROR: Second arg needs to be a bundle ID to use e.g. com.company.product" && exit 1
40+ fi
41+
42+ if [ -z " $AC_USERNAME " ; then
43+ echo " ERROR: Third arg needs to be set the the app specific Apple username" && exit 1
44+ fi
45+
46+ if [ -z " $AC_PASSWORD " ; then
47+ echo " ERROR: Fourth arg needs to be set the the app specific Apple password" && exit 1
48+ fi
49+
50+
51+ # ============================================================
52+ # Setup variables
53+ # ============================================================
54+ PATH_TO_NOTARISE=" $APP_PATH "
55+ EXTENSION=" ${PATH_TO_NOTARISE##* .} "
56+ echo " $EXTENSION "
57+
58+ TMP=" $ROOT /tmp"
59+ rm -rf " $TMP "
60+ mkdir " $TMP "
61+
62+ function onExit {
63+ rm -rf " $TMP "
64+ }
65+ trap onExit EXIT
66+
67+ # Create zip to notarise
68+ if [ " $EXTENSION " = " app" ; then
69+ ZIP_PATH=" $TMP /upload.zip"
70+ PATH_TO_NOTARISE=" $ZIP_PATH "
71+
72+ # ============================================================
73+ # First check if notarization will succeed
74+ # ============================================================
75+ echo " ============================================================"
76+ echo " Validating file:"
77+ spctl -vvv --assess --type exec " $APP_PATH "
78+ codesign -dvv " $APP_PATH "
79+ codesign -vvv --deep --strict " $APP_PATH "
80+
81+ # Create a ZIP archive suitable for altool
82+ rm -rf " $ZIP_PATH "
83+ /usr/bin/ditto -c -k --keepParent " $APP_PATH " " $ZIP_PATH "
84+ fi
85+
86+ if [ ! -f " $PATH_TO_NOTARISE " && [ ! -d " $PATH_TO_NOTARISE " ; then
87+ echo " ERROR: No file to notarise at: $PATH_TO_NOTARISE " && exit 1
88+ fi
89+
90+
91+ # ============================================================
92+ # Upload to notarization service
93+ # ============================================================
94+ echo " ============================================================"
95+ echo " Uploading to notarization service:"
96+
97+ OUTPUT=$( xcrun altool --notarize-app --primary-bundle-id " $BUNDLE_ID " " $AC_USERNAME " " $AC_PASSWORD " " $PATH_TO_NOTARISE " )
98+ OUTPUT_FILE=" $TMP /result.plist"
99+ rm -f " $OUTPUT_FILE "
100+ echo " $OUTPUT " > " $OUTPUT_FILE "
101+ REQUEST_UID=$( /usr/libexec/PlistBuddy -c " Print notarization-upload:RequestUUID" " $OUTPUT_FILE " )
102+ rm -f " $OUTPUT_FILE "
103+ echo " $REQUEST_UID "
104+
105+
106+ # ============================================================
107+ # Check status
108+ # ============================================================
109+ echo " ============================================================"
110+ echo " Checking notarization status:"
111+
112+ tries=0
113+ for (( ; ; )) ; do
114+ echo " ` pwd` "
115+ echo " xcrun altool --notarization-info " $REQUEST_UID " --username " $AC_USERNAME " --password " $AC_PASSWORD " --output-format xml"
116+
117+ if [ " $tries " -gt 24 ]; then
118+ exit 1
119+ fi
120+
121+ set +e
122+ STATUS_PLIST=$( xcrun altool --notarization-info " $REQUEST_UID " " $AC_USERNAME " " $AC_PASSWORD " )
123+ if [ $? -ne 0 ]; then
124+ sleep 5
125+ tries=$(( tries+ 1 ))
126+ continue
127+ fi
128+ set -e
129+
130+ STATUS_FILE=" $TMP /status.plist"
131+ echo " $STATUS_FILE "
132+ rm -f " $STATUS_FILE "
133+ echo " $STATUS_PLIST " > " $STATUS_FILE "
134+ STATUS=$( /usr/libexec/PlistBuddy -c " Print notarization-info:Status" " $STATUS_FILE " )
135+ echo " STATUS: $STATUS "
136+
137+ case " $STATUS " in
138+ " success"
139+ echo " COMPLETED:" $( /usr/libexec/PlistBuddy -c " Print notarization-info:LogFileURL" " $STATUS_FILE " )
140+ break
141+ ;;
142+ " in progress"
143+ sleep 5
144+ ;;
145+ * )
146+ echo " ERROR:" $( /usr/libexec/PlistBuddy -c " Print notarization-info:'Status Message'" " $STATUS_FILE " )
147+ echo " LOG_URL:" $( /usr/libexec/PlistBuddy -c " Print notarization-info:LogFileURL" " $STATUS_FILE " )
148+ exit 1
149+ ;;
150+ esac
151+ done
152+
153+
154+ # ============================================================
155+ # Staple to binary
156+ # ============================================================
157+ if [ " $EXTENSION " != " zip" ; then
158+ echo " ============================================================"
159+ echo " Stapling certificate:"
160+ xcrun stapler staple " $APP_PATH "
161+ xcrun stapler staple -v " $APP_PATH "
162+ fi
0 commit comments